ax secret
Manage the org's write-only secret store.
Secrets are referenced from experiment YAML as ax://secrets/<slug> (see
Environment and Auth). The store is write-only: no
command ever prints a secret value.
| Command | Use |
|---|---|
secret set | Create or overwrite a secret value. |
secret list | List slugs and audit metadata. |
secret view | One secret's metadata and YAML reference. |
secret delete | Remove a secret by slug. |
All commands accept --org <org-id>; list and view also accept --json.
secret set
Create or overwrite a secret. The value is read from a hidden prompt at a TTY, or from stdin when piped; it is never echoed and never returned.
printf '%s' "$VALUE" | ax secret set <SLUG>| Argument / flag | What it does |
|---|---|
<SLUG> | Required. Store key used in ax://secrets/<slug> (kebab-case). |
--description <text> | Optional note. Omitting it on an update preserves the existing description. |
Examples:
# Pipe a value from the environment, with an audit note
printf '%s' "$GITHUB_TOKEN" | ax secret set github-token --description "CI PAT"
# Then reference it from experiment YAML:
# environment_variables:
# - name: GITHUB_TOKEN
# value: ax://secrets/github-tokensecret list
List slugs, descriptions, and audit metadata. Values are never returned.
ax secret list| Argument / flag | What it does |
|---|---|
--limit <n> | Max secrets (default 100). |
--page-token <token> | Cursor from the previous page. |
secret view
Show one secret's metadata plus the ax://secrets/<slug> reference to paste
into YAML. Never the value.
ax secret view <SLUG>secret delete
Remove a secret by slug. Missing slugs are treated as already gone.
ax secret delete <SLUG> [--yes]| Argument / flag | What it does |
|---|---|
<SLUG> | Required. Secret slug to remove. |
--yes | Skip the confirmation prompt (required when stdin is not a TTY). |